pixcakeai

This skill appears to do exactly what it says: apply CCD-style enhancements and optionally add a bottom watermark, all in-memory with no external network calls or credential use. Things to consider before installing: (1) It depends on the 'sharp' native package — deployment will install native binaries which can increase attack surface and require build toolchain on some hosts. (2) Large or specially crafted images could use substantial memory (potential DoS/resource exhaustion risk); consider size limits or request throttling. (3) The watermark text is HTML-escaped for &, <, >, and "; that mitigates common SVG injection but is a simple sanitizer — if you accept arbitrary untrusted input you may want stricter validation. (4) SKILL.md claims 'no data retention' and the code writes nothing to disk, but verify the hosting environment's logging/retention policies if privacy is a concern. Overall the package is internally coherent and there are no obvious indicators of malicious behavior.